GDPR and Swiss FADP alignment

Reality Twin is aligned with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP). This article covers the roles, the rights, and exactly how to satisfy a data-subject request from your dashboard.

Roles

• You are the controller of your visitors' personal data.
• Reality Twin is your processor.
• The relationship is governed by our standard Data Processing Addendum (see /dpa) which we countersign on request.

Data-subject rights we help you meet

• Access — export all data tied to a person.
• Rectification — correct data you hold about them.
• Erasure — delete data on request, plus scheduled deletion after retention expires.
• Restriction — mark data as restricted pending resolution.
• Portability — export in a machine-readable format (JSON).
• Objection — stop processing on request.

How to satisfy a request

1. Open Settings → Data → Personal data.
2. Search by the person's email.
3. Review the returned records (conversations, leads, uploaded content mentioning them).
4. Export or delete in one click.
5. The action is logged for your audit trail.

Cross-border transfers

Where data must leave the EU (rare — see Where is my data stored?), transfers use Standard Contractual Clauses (SCCs) plus supplementary technical measures: TLS 1.3 in transit, AES-256 at rest, and access minimisation.

Records of processing

Reality Twin maintains records of processing activities under Article 30 GDPR. On Enterprise plans we provide a customer-specific processing record on request.

Certifications and audits

Frequently asked questions

Do you offer a DPA?

Yes — see Sign a DPA. Countersigned within two business days.

Where is the sub-processor list?

On /dpa. DPA signatories are notified in advance of any change.

How do I report a data incident?

Email hello@realitytwin.io. We acknowledge within one business day and follow the notification timelines in the DPA.